version: "1.0.1" name: vulnerability-analysis description: Perform deep analysis of CVEs and security vulnerabilities including CVSS scoring, affected versions, exploit maturity, and remediation steps. Use when the user needs detailed vulnerability intelligence.

Vulnerability Analysis

Use this skill when the user asks for detailed vulnerability analysis beyond basic CVE lookup.

When to Use

• User asks "how serious is this vulnerability?"
• User asks about exploit availability or PoC code
• User wants to understand impact on their specific infrastructure
• User asks about mitigation or remediation steps
• User wants to prioritize which vulnerabilities to fix first

Workflow

0. Goal and Todo (Agent mode)

Before any lookup, call formulate_plan(steps), then start step 1 with transition_step(id, "in_progress"); tool calls are refused until a step is in progress.

• Goal: generated from the request and pinned above the plan, e.g. "Decide how urgently CVE-2024-1234 must be fixed on our assets, with the affected hosts and the fix". Pass a goal to formulate_plan only to correct it.
• Steps: the sections below, trimmed to what the goal needs — gather workspace data, enrich from external sources, analyze, present findings (and track the issue when asked).

Keep the analysis on the pinned goal: CVEs or assets that come up but are not part of it go under next steps.

1. Gather Vulnerability Data

Start with built-in OASM tools to get workspace context:

2. Enrich with External Sources

For deeper analysis, use retrieve_web_page to fetch from these sources:

CVE Details:

• Trickest CVE: https://raw.githubusercontent.com/trickest/cve/refs/heads/main/{YEAR}/CVE-{YEAR}-{NUMBER}.md
• NVD API: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-{YEAR}-{NUMBER}

Exploit Intelligence:

• GitHub PoC search: https://github.com/nomi-sec/PoC-in-GitHub
• Exploit-DB: https://www.exploit-db.com/search
• Metasploit modules: https://www.rapid7.com/db/modules/

Vendor Advisories:

• Microsoft MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-{YEAR}-{NUMBER}
• Apache security: https://lists.apache.org/thread/

3. Analyze the Vulnerability

For each vulnerability, evaluate these dimensions:

Severity Assessment

• CVSS v3.1 base score and vector string
• EPSS (Exploit Prediction Scoring System) if available
• CISA KEV (Known Exploited Vulnerabilities) catalog status
• Contextual severity: is the affected component internet-facing?

Exploit Maturity

Categorize the exploit status:

• None: No known exploits
• PoC: Proof-of-concept code exists (GitHub, write-ups)
• Functional: Exploit works reliably but not mass-deployed
• Weaponized: Used in real attacks, available in exploit frameworks

Affected Scope

• List affected products and versions from the CVE
• Cross-reference with workspace assets using enumerate_assets and fingerprint_technologies
• Determine exposure: internet-facing vs internal-only

Remediation Guidance

• Patch availability and version
• Workarounds if no patch exists (WAF rules, network segmentation, disable feature)
• Priority level:
• Immediate: Exploited in the wild (check CISA KEV)
• High: Functional exploit or PoC available
• Medium: Vulnerable but no known exploit
• Low: Informational or low-impact

4. Present Findings

Structure your analysis as:

**Goal**: Met / Partly met / Not met — one line on why
 
**Summary**: One-line overview of the vulnerability
 
**Severity**: CVSS score + vector + EPSS (if available)
 
**Exploit Status**: None / PoC / Functional / Weaponized
 
**Affected Assets**: X assets in your workspace match
- asset1.example.com (nginx 1.18)
- asset2.example.com (Apache 2.4.49)
 
**Impact**: What an attacker can achieve (e.g., RCE, data leak, DoS)
 
**Remediation**: Specific steps with version numbers
- Upgrade to X.Y.Z or later
- Temporary: apply WAF rule / disable feature
 
**Priority**: Immediate / High / Medium / Low

5. Track the Issue

After analysis:

• If no existing issue, suggest creating one via the Issues system
• Store key findings in stm_write for reference during the conversation
• Use ltm_append to persist critical vulnerability intelligence for the workspace